pompelmi

pompelmi is a powerful, open-source file scanning tool tailored specifically for Node.js applications, ensuring that untrusted file uploads are thoroughly scanned before they are ever written to disk. Leveraging TypeScript, pompelmi operates entirely in-process, ensuring that no data is shared externally, making it a privacy-focused solution.

Key Features:

• Real-time Malware Protection: Effectively classify uploads as clean, suspicious, or malicious, preventing risky files from being processed.
• Comprehensive Scanning Capabilities: Integrated ZIP deep-inspection, alongside optional YARA engine compatibility, allows detection of complex threats including ZIP bomb attacks and harmful file macros.
• Flexible Adapters: Compatible with popular web frameworks like Express, Koa, and Next.js, facilitating seamless integration into existing applications.
• TypeScript Integration: Built with modern TypeScript for a minimal and typed API, ensuring an enhanced developer experience.

Overview of Functionalities:

• Early Detection: Files are scanned at the earliest stage, halting potential threats before they can be stored.
• Adaptable Scanners: Supports custom scanning strategies and heuristics alongside built-in scanners, enabling tailored security policies.
• Security Focused Architecture: Scanning occurs entirely within the application process without making external calls, ensuring that user data remains within the local environment.

Implementation Example:

Integrating pompelmi into an Express application is straightforward:

import express from 'express';
import multer from 'multer';
import { createUploadGuard } from '@pompelmi/express-middleware';
import { policy, scanner } from './security';

const app = express();
const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: policy.maxFileSizeBytes } });

app.post('/upload', upload.any(), createUploadGuard({ ...policy, scanner }), (req, res) => {
  res.json({ ok: true, scan: (req as any).pompelmi ?? null });
});

app.listen(3000, () => console.log('Server running on http://localhost:3000'));

Supported Frameworks:

Why Choose pompelmi?

• Ideal for applications that handle sensitive files and cannot rely on third-party antivirus solutions.
• Provides low-latency decision-making directly within the application stack.
• Encourages a secure coding environment with a clear policy and scanning framework.

pompelmi stands as a robust choice for developers seeking an effective and customizable file scanning solution, enhancing the security of file uploads while maintaining a focus on privacy and performance.